Data Processing Agreement

This Data Processing Agreement ("DPA") is entered into on [Date] between [Platform Legal Name] ("Company", "Data Fiduciary") and [Vendor Legal Name] ("Processor"), a provider of [cloud hosting/analytics/customer support/other] services to the Company, and forms part of and supplements the underlying services agreement between the Parties dated [●] ("Principal Agreement").

1. DEFINITIONS

1.1  Terms such as "Data Fiduciary", "Data Processor", "Data Principal", "personal data", and "personal data breach" shall have the meanings assigned under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules").

2. SCOPE AND PURPOSE OF PROCESSING

2.1  The Processor shall process personal data (including health-related information submitted by Users) solely for the purpose of providing the services described in the Principal Agreement, namely [describe: hosting, storage, analytics, customer support ticketing, etc.], and for no other purpose.

2.2  The Processor shall process personal data strictly on the documented instructions of the Company and shall not process such data for its own purposes, including for training any model or algorithm, without the Company's prior written consent.

3. SECURITY SAFEGUARDS

3.1  The Processor shall implement and maintain reasonable security safeguards, including encryption of personal data in transit and at rest, access controls on a need-to-know basis, logging sufficient to detect and investigate a personal data breach, and periodic vulnerability assessment, consistent with the standard expected under the DPDP Rules.

3.2  The Processor shall ensure that its personnel with access to personal data are bound by confidentiality obligations no less protective than those in this DPA.

4. SUB-PROCESSING

4.1  The Processor shall not engage any sub-processor to process personal data without the Company's prior written consent, and any approved sub-processor shall be bound by data protection obligations no less onerous than those set out in this DPA.

5. BREACH NOTIFICATION

5.1  The Processor shall notify the Company without undue delay, and in any event within 24 hours of becoming aware, of any personal data breach affecting data processed under this DPA, providing sufficient information to enable the Company to comply with its own breach-notification obligations to the Data Protection Board of India and affected Data Principals under the DPDP Rules.

6. ASSISTANCE WITH DATA PRINCIPAL RIGHTS

6.1  The Processor shall, upon request, promptly assist the Company in responding to requests from Data Principals to exercise rights of access, correction, and erasure under the DPDP Act.

7. DATA RETENTION AND DELETION

7.1  Upon termination of the Principal Agreement or upon the Company's written instruction, the Processor shall, at the Company's election, return or securely delete all personal data processed under this DPA, and certify such deletion in writing, save to the extent retention is mandated by applicable law.

8. CROSS-BORDER TRANSFER

8.1  The Processor shall not transfer personal data outside India except to a jurisdiction not restricted by the Central Government under the DPDP Act, and shall inform the Company of the location(s) where personal data is stored or processed.

9. AUDIT RIGHTS

9.1  The Company may, on reasonable notice, audit or request evidence of the Processor's compliance with this DPA, including security certifications (e.g., ISO 27001) held by the Processor.

10. LIABILITY AND INDEMNITY

10.1  The Processor shall indemnify the Company against any regulatory penalty, claim, or loss arising from the Processor's breach of this DPA or of its obligations as a processor under the DPDP Act.

11. TERM AND GENERAL

11.1  This DPA shall remain in effect for so long as the Processor processes personal data on behalf of the Company under the Principal Agreement. This DPA is governed by the laws of India, and disputes shall be resolved in accordance with the dispute resolution clause of the Principal Agreement.

IN WITNESS WHEREOF

the Parties have executed this Agreement through their authorised representatives on the date first written above.